Security feed

24 October 2026

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability

Kaseya Virtual System/Server Administrator (VSA) contains an information disclosure vulnerability allowing an attacker to obtain the sessionId that can be used to execute further attacks against the system. CISA required action: Apply updates per vendor instructions.

Virtual System/Server Administrator (VSA)CVE-2021-30116

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-30116

Virtual System/Server Administrator (VSA)

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-30116
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3587 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:37:52 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Kaseya VSA Remote Code Execution Vulnerability

Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. CISA required action: Apply updates per vendor instructions.

Virtual System/Server Administrator (VSA)CVE-2018-20753

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-20753

Virtual System/Server Administrator (VSA)

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-20753
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2623 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:21:51 GMT
Publisher date: Wed, 13 Apr 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Kaseya VSA SQL Injection Vulnerability

ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. CISA required action: The impacted product is end-of-life and should be disconnected if still in use.

Virtual System/Server Administrator (VSA)CVE-2017-18362

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2017-18362

Virtual System/Server Administrator (VSA)

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2017-18362
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2564 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:20:24 GMT
Publisher date: Tue, 24 May 2022 00:00:00 GMT

Read the original announcement